ca7339c4a1cb94be338a91f67568a9ad466c60e49b5369988ee1b3643f31e3ec

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 12:29

Target
oxide-stub.exe
Size 8.9MB
Sample260925-ppdzcassbt
SHA256 ca7339c4a1cb94be338a91f67568a9ad466c60e49b5369988ee1b3643f31e3ec
MD5 46c944a52a33dea9c42f9ffa801a5b83
SHA1 c383da0f4469c23189d86c9bbb340a620b46eb44
SHA512 9b158bd3ac2cf1316908a6242c6ceb4a608acdc4704f7cac77d99e1fa4c8df80a450df9d3a248f1a30462fa3b45af83119cb7b1b3df6a939d083e2c8f085cc73
SSDEEP 196608:emLdfxKD20P9GVNYeSXWr1Hh0rhPK/ndpc0cWb:eEd0D20P9G8d+Bh0rhPK/nd/c
TLSH
T19C96332377F625F8F44BC33905528A245A31718497A4A9FB233196359D7ABE22F3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4392	CompPkgSrv.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 4392	3504	oxide-stub.exe	87

C:\Users\Admin\AppData\Local\Temp\oxide-stub.exe
"C:\Users\Admin\AppData\Local\Temp\oxide-stub.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\CompPkgSrv.exe
  "C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\CompPkgSrv.exe"
  2⤵
  - Executes dropped EXE
  PID:4392

CompPkgSrv.exe

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\CompPkgSrv.exe
Size 8.9MB
SHA256 ca7339c4a1cb94be338a91f67568a9ad466c60e49b5369988ee1b3643f31e3ec
MD5 46c944a52a33dea9c42f9ffa801a5b83
SHA1 c383da0f4469c23189d86c9bbb340a620b46eb44
SHA512 9b158bd3ac2cf1316908a6242c6ceb4a608acdc4704f7cac77d99e1fa4c8df80a450df9d3a248f1a30462fa3b45af83119cb7b1b3df6a939d083e2c8f085cc73
SSDEEP 196608:emLdfxKD20P9GVNYeSXWr1Hh0rhPK/ndpc0cWb:eEd0D20P9G8d+Bh0rhPK/nd/c
TLSH
T19C96332377F625F8F44BC33905528A245A31718497A4A9FB233196359D7ABE22F3F702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download